Upload static model scanning canary

README.md

@@ -0,0 +1,29 @@
+---
+library_name: transformers
+tags:
+- ctf
+- model-scanning
+- supply-chain-canary
+- static-analysis
+license: apache-2.0
+---
+
+# WWTCyberLab/static-canary-pt-loader-risk
+
+This is an inert CTF canary model repository for Cisco SecureAI model
+scanning demos. It is intentionally designed to look risky to static
+model scanners while avoiding destructive behavior.
+
+Expected scanner themes:
+
+- `model.pt` contains a Python protocol-2 pickle reducer for
+  `__builtin__.set`. Loading it constructs only a normal set of static
+  strings, including `CTF_MODEL_CANARY`.
+- `config.json` includes `auto_map` metadata so scanners can exercise
+  `trust_remote_code` review paths.
+- `modeling_static_canary.py` imports modules commonly flagged by
+  loader-risk scanners, but import and model construction have no
+  subprocess, filesystem, or network side effects.
+
+Runtime canary events should be emitted by the lab harness, not hidden
+inside the model artifact.

canary_manifest.json

@@ -0,0 +1,15 @@
+{
+  "canary_token": "CTF_MODEL_CANARY",
+  "checkpoint": "model.pt",
+  "checkpoint_sha256": "62367b6107f5aaafaf556b33a228588059dc3edcc9b679d6fbce86d490d9fab4",
+  "contains_active_payload": false,
+  "expected_static_indicators": [
+    "pickle GLOBAL __builtin__ set",
+    "HF auto_map remote-code review path",
+    "scanner-visible imports: os, sys, subprocess",
+    "obfuscated static marker: base64 canary token"
+  ],
+  "repo_id": "WWTCyberLab/static-canary-pt-loader-risk",
+  "runtime_sink_example": "http://twinshadow-exfil.local/v1/ingest",
+  "runtime_sink_note": "Use scripts/emit_model_canary_event.py from the lab harness."
+}

config.json

@@ -0,0 +1,14 @@
+{
+  "architectures": [
+    "StaticCanaryModel"
+  ],
+  "auto_map": {
+    "AutoModel": "modeling_static_canary.StaticCanaryModel"
+  },
+  "canary_token": "CTF_MODEL_CANARY",
+  "model_type": "static_canary",
+  "repo_id": "WWTCyberLab/static-canary-pt-loader-risk",
+  "static_only": true,
+  "torch_dtype": "float32",
+  "transformers_version": "ctf-static-fixture"
+}

model.pt

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:62367b6107f5aaafaf556b33a228588059dc3edcc9b679d6fbce86d490d9fab4
+size 476

modeling_static_canary.py

@@ -0,0 +1,42 @@
+"""No-op remote-code canary for model scanning CTFs.
+
+This module is intentionally inert. Importing it has no filesystem,
+subprocess, or network side effects. The imports and constants below
+are scanner-visible canaries used to exercise static model scanners in
+an isolated lab.
+"""
+
+from __future__ import annotations
+
+import base64
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+REPO_ID = 'WWTCyberLab/static-canary-pt-loader-risk'
+CTF_MODEL_CANARY = 'CTF_MODEL_CANARY'
+ENCODED_CANARY = 'Q1RGX01PREVMX0NBTkFSWQ=='
+SINK_FRAGMENTS = ("http://", "twinshadow-exfil", ".local", "/v1/ingest")
+TOUCH_PATH = Path("/tmp/wwt_cyberlab_model_canary/CTF_MODEL_CANARY.txt")
+
+
+class StaticCanaryModel:
+    """Tiny stand-in model used only to make HF auto_map resolvable."""
+
+    config_class = None
+
+    def __init__(self, config=None):
+        self.config = config
+
+    @classmethod
+    def from_pretrained(cls, *args, **kwargs):
+        return cls(kwargs.get("config"))
+
+    def __call__(self, *args, **kwargs):
+        return {"canary": CTF_MODEL_CANARY, "static_only": True}
+
+
+def decode_canary() -> str:
+    return base64.b64decode(ENCODED_CANARY.encode("ascii")).decode("utf-8")

tokenizer_config.json

@@ -0,0 +1,5 @@
+{
+  "canary_token": "CTF_MODEL_CANARY",
+  "model_max_length": 16,
+  "tokenizer_class": "StaticCanaryTokenizer"
+}